CVE-2026-54903: Oj Ruby Gem Buffer Overflow Vulnerability

CVE-2026-54903 Overview

CVE-2026-54903 is an integer overflow vulnerability in Oj (Optimized JSON), a widely used JSON parser and object marshaller distributed as a Ruby gem. The flaw exists in Oj.load when parsing JSON strings larger than 2 GB. An integer overflow in buf_append_string at buf.h:61 converts the string length to a large negative size_t, causing memcpy to copy an oversized region out of bounds. The result is a process crash and potential corruption of adjacent heap memory. The maintainers addressed the issue in Oj version 3.17.2. The weakness is classified under [CWE-190] Integer Overflow or Wraparound.

Critical Impact
Attackers who supply JSON payloads larger than 2 GB to applications using vulnerable Oj versions can trigger heap corruption and denial of service in the Ruby process.

Affected Products

Oj (Optimized JSON) Ruby gem versions prior to 3.17.2
Ruby applications invoking Oj.load on untrusted JSON input
Services exposing JSON parsing endpoints backed by vulnerable Oj versions

Discovery Timeline

2026-07-01 - CVE-2026-54903 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-54903

Vulnerability Analysis

Oj is a high-performance JSON parser for Ruby. The vulnerability affects the internal buffer management routine buf_append_string located in buf.h at line 61. When Oj.load processes a JSON string exceeding 2 GB, the length calculation overflows the signed integer range used for arithmetic on the buffer size. The overflow produces a very large negative value that is later interpreted as an unsigned size_t argument to memcpy. The memory copy then attempts to write an astronomically large region out of bounds, corrupting adjacent heap structures and crashing the Ruby process. Applications that accept large JSON payloads over the network, from message queues, or from file uploads are directly exposed.

Root Cause

The root cause is an unchecked arithmetic operation on the string length before it is passed to a memory copy routine. Oj does not validate that the incoming length remains within safe bounds prior to conversion, so a 2 GB or larger input wraps into a negative value. The negative value is then treated as an unsigned size, producing an out-of-bounds memcpy destination range and heap metadata corruption.

Attack Vector

Exploitation requires an attacker to deliver a JSON document larger than 2 GB to a function using Oj.load. The attack vector is network-adjacent for any Ruby web service, API endpoint, or worker process that deserializes attacker-controlled JSON without an upstream size limit. The primary observable outcome is a crash of the Ruby process. Because the flaw corrupts adjacent heap memory, memory-safety consequences beyond denial of service cannot be excluded, though the CVSS scoring emphasizes availability impact.

The vulnerability manifests in the buf_append_string helper in buf.h. See the GitHub Security Advisory GHSA-475m-ph3x-64gp for the maintainer's technical description and fix commit.

Detection Methods for CVE-2026-54903

Indicators of Compromise

Unexpected SIGSEGV or SIGABRT crashes in Ruby processes shortly after receiving large JSON payloads.
HTTP request logs showing Content-Length values at or above 2 GB against JSON endpoints.
Worker processes terminated with heap corruption diagnostics from glibc or jemalloc.

Detection Strategies

Inventory Ruby applications and identify dependencies on oj gem versions prior to 3.17.2 using bundle list or SBOM tooling.
Instrument JSON parsing entry points to log payload sizes and alert on requests exceeding a defined threshold well below 2 GB.
Enable core dump collection on Ruby application servers so crashes tied to Oj can be attributed to this CVE.

Monitoring Recommendations

Monitor reverse proxies and load balancers for anomalously large request bodies directed at JSON APIs.
Track process restart counts and memory faults in orchestration platforms such as Kubernetes to surface crash loops.
Correlate WAF telemetry with application logs to detect repeated oversized JSON submissions from single sources.

How to Mitigate CVE-2026-54903

Immediate Actions Required

Upgrade the oj gem to version 3.17.2 or later across all Ruby applications and rebuild deployment artifacts.
Enforce request body size limits at reverse proxies, API gateways, and Rack middleware to reject payloads far below 2 GB.
Audit background job processors and file ingestion paths that call Oj.load on untrusted input.

Patch Information

The issue is fixed in Oj version 3.17.2. Update the gem constraint in Gemfile to gem "oj", ">= 3.17.2" and run bundle update oj. Refer to the GitHub Security Advisory GHSA-475m-ph3x-64gp for the full patch reference.

Workarounds

Configure Nginx, HAProxy, or the application server with client_max_body_size or equivalent directives set to a reasonable JSON size limit.
Wrap Oj.load calls with explicit length checks that reject inputs above a safe threshold before parsing.
Route large document processing through streaming parsers rather than in-memory deserialization.

bash

# Configuration example
bundle update oj --conservative
bundle list | grep oj
# Nginx body size cap to block oversized JSON before it reaches Ruby
# add to server or location block:
# client_max_body_size 10m;